Training Management in a Regulated QMS: Competency, Effectiveness, and Part 11

Training records that say "read and understood" on the wrong SOP version are a gift to an investigator. In a regulated QMS, training software has to prove competency for the role, effectiveness when the procedure requires it, and Part 11 integrity when the record is electronic.

This article is for Quality Managers, training coordinators, and system owners under ISO 13485:2016 clause 6.2, FDA QMSR, and 21 CFR Part 11. FDA QMSR context: QMSR Frequently Asked Questions.

Cloudtheapp connects training to document control and to the records people are allowed to complete. Use the requirements below on any validated platform.

Competency is not attendance

ISO 13485 asks for competence, awareness, and training. Competence means the person can do the job. A slide deck with a checkbox is awareness at best.

Define, in the procedure:

• GxP roles (example: incoming inspector, batch record reviewer, complaint intake, CAPA investigator, internal auditor)
• Required documents and skills per role
• How you assess competence for high-risk tasks (observed qualification, quiz with a pass score, second-person verification period)
• Requalification interval or event triggers (procedure revision, deviation, new equipment)

Software must store the role, the requirements, the evidence, and the date. A learning-management system that does not know your SOP versions will train people on yesterday's process.

Document-control handshake

• Assignment created from document type, role, and site
• Version locked: completing training on SOP-12 v3 does not count for v4
• Effective date logic: people are not asked to train on a draft, and the line is not asked to use a document nobody trained on
• Revision classification: editorial change may not require retraining; process change does
• Overdue list by supervisor and by QA

This handshake is why training should live in the QMS or in a validated integration, not in a general HR course catalog that never sees SOP numbers.

Effectiveness

When your SOP requires effectiveness of training (common after CAPA or after a major process change):

• Method: quiz threshold, observed task, record error rate over a defined window
• Owner and due date after the training date
• Fail path: requalify, restrict duties, or reopen CAPA
• Evidence stored on the training record

If effectiveness is a quarterly email that says "any issues?" you will not survive a focused inspection on that process.

Part 11 controls

• Unique user IDs; no shared "training account"
• Identification of the trainee; the supervisor cannot click complete for six people unless the SOP allows documented proxy training with the trainee still acknowledging
• Signature meaning: "I completed this training" versus "I qualified this person"
• Time stamp and (if you use it) reason for late completion
• Audit trail if a completion is voided or corrected
• Retention aligned to the training SOP and to record retention for the processes those people touched

Part 11 is not a logo on a brochure. It is identification, signature manifestation, and the ability to reconstruct who attested to what.

Onboarding, contractors, and temporary staff

• Role assigned before GxP task access
• Contractors time-boxed
• Visitors versus qualified technicians distinguished
• Temporary agency staff requalified when they return after a gap your SOP defines

The inspection story writes itself when a weekend contractor released a line with no training record.

Link to access

The strongest control: the person cannot approve a batch record, close a CAPA, or sign a complaint until required training is complete. Not every company wants a hard gate on day one. If you delay the gate, QA must have a daily overdue view and a written exception process.

Reporting

• Percent complete by role and site
• Overdue GxP roles
• Training on superseded versions still open (should be zero)
• Qualification upcoming expiry
• CAPA-driven training still open

Management review should see these without a new spreadsheet.

Validation

Intended use: which roles, which gates, which integrations to document control. Risk is high because a wrong completion can put an unqualified person on a GxP task. Test the gate you claim to have. Vendor packages cover the platform; you still test configuration.

Demo script

Create a role, attach SOP v1, complete training, revise SOP to v2 classified as requiring retraining, confirm v1 completion no longer qualifies, attempt to approve a record, show the block or the overdue exception. Export the audit trail of a voided completion.

Cloudtheapp Fast Track often puts document control and training in the first wave for this reason. If you cannot name a training owner, do not promise a 30-day go-live that includes a hard gate.

Refuse to buy

Refuse a course catalog that cannot lock SOP version, cannot separate trainee signature from trainer qualification, or cannot show overdue GxP roles by site. Attendance software is not a regulated training system.